In an established log collecting system of the related art, logs from multiple parts of a distributed system are individually collected by log collecting apparatus respectively installed on the multiple parts of the distributed system. The logs collected by each log collecting apparatus are then centrally managed at a log managing apparatus. Furthermore, in this log management system, the following processes exist: an error log monitoring process, which monitors error logs on the distributed system; and a trace log collection process, which collects all logs on the distributed system.
When executing the error log monitoring process, the log collecting apparatus check the log contents at short intervals, while prioritizing real-time performance and reduced network load. Only log records that are determined to be errors (i.e., error logs) are forwarded to the log managing apparatus. When executing the trace log collection process, the log collecting apparatus utilize a period of low network load, such as nighttime, and all unsent log records on the distributed system (i.e., trace logs) are forwarded to the log managing apparatus. Since the error log monitoring process and the trace log collection process differ in their usage properties, each process is executed independently.
Meanwhile, network load has become a serious problem in such log collecting systems in recent years. This is because, as the scale of the system increases, greater amounts of data must be forwarded to the log managing apparatus from each log collecting apparatus when executing the error log monitoring process or the trace log collection process. Thus, in log management systems of the related art, techniques have been implemented to minimize the amount of data forwarded to the log managing apparatus from each log collecting apparatus (see, for example, Japanese Unexamined Patent Application Publication Nos. H2-302844 and 2003-216457).
However, even if the amount of data forwarded to the log managing apparatus from each log collecting apparatus is minimized in log collecting systems of the related art, duplicate data is still forwarded by the error log monitoring process and the trace log collection process. For example, if a log collecting apparatus detects an error log when executing the error log monitoring process, then that error log will be forwarded to the log managing apparatus. However, when executing the trace log collection process, the trace log containing that error log will also be forwarded to the log managing apparatus, and the error log is thus forwarded twice. Consequently, as the number of data-forwarding log collecting apparatus and parts in the distributed system increases, the amount of forwarded duplicate data also increases, and the load on the network becomes larger.